Here's what the 2024 NCAA Rulebook says about Defensive Holding:

This is Article 9-3-4:

(a)  Defensive players may use hands and arms to push, pull, ward off or lift offensive players:

1. When attempting to reach the runner. 

2. Who are obviously attempting to block them.

(b) A defensive player legally may use their hands or arms to ward off or block an opponent in an attempt to reach a loose ball:

1. During a backward pass, fumble or kick that they are eligible to touch.
2. During any forward pass that crossed the neutral zone and has been touched by any player or official.

(c) When making no attempt to get at the ball or the runner, defensive players must comply with Article 3, paragraphs a and b above.

(d) Defensive players may not use hands and arms to tackle, hold or otherwise illegally obstruct an opponent other than a runner.

(e) Defensive players may ward off or legally block an eligible pass receiver until that player occupies the same yard line as the defender or until the opponent could not possibly block him. Continuous contact is illegal 

PENALTY [c-e]—10 yards plus automatic first down if the first down is not in conflict with other rules (emphasis added, citations omitted)

No mention of five yards (that is the NFL illegal contact rule), but your point is taken because "Continuous contact is illegal," so the fact the contact last for 5+ yards is proof of a penalty being committed. Beyond that it's clear the Ute defender's actions fell within the prohibited actions under this rule. He used his hands to hold and illegal obstruct an opponent other than a runner and the receiver was not blocking him.